Build trust with Privacy in 2024

Demonstrate compliance with one or more global regulations like GDPR and CCPA/CPRA
to earn trust and grow revenue with enterprise customers. 

soc2-explained-video-cover
SOC 2 STANDARD

Is this the year you grow with SOC 2?

There’s no better standard to baseline your information security and earn trust with a broad customer base.

AssuranceLab is a registered CPA and CA firm ready to help you earn trust with SOC 2 in the US and globally.

We provide end-to-end readiness and audit services, with a cloud-native and agile approach that enables you to work at your own pace.

alab-network-countries-and-employees

You’re in great company. We work with hundreds of fast-growing software companies across 13 countries, ranging in size from 2 to 26,000 employees.

alab-network-countries-and-employees-1

We work with more than 700 fast-growing companies across 20+ countries, ranging in size from 2 to 26,000+ employees.

PRIVACY ATTESTATIONS

Privacy compliance

that earns trust

Privacy attestations for GDPR, CCPA/CPRA, and other regional regulations give peace of mind to enterprise

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that sets out rules and guidelines for the processing and protection of personal data within the European Union (EU). 

The California Consumer Privacy Act (CCPA) of 2018 is a state-wide data privacy law that regulates how businesses all over the world are allowed to handle the personal information (PI) of California residents. 

As a registered CPA and CA firm ready to help you earn trust with privacy compliance globally, we provide complete audit services, with a cloud-native and agile approach. This enables you to work at a pace that suits you rather than navigate the traditional complex audit model. 

Ready to get started with privacy attestations? 

alab-soc2-image
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital
  • Vital

THE PROCESS

Four Steps to Privacy

left arrow right arrow
Privacy Readiness Assessment

Privacy Readiness Assessment

Integrating with many compliance platforms, we provide a tailored view of your controls and any gaps to help you prepare for your audit.

Remediation Support

Remediation Support

We guide you as you address any gaps and implement fit-for-purpose processes that align with your culture, the nature of the data collected, and your specific privacy requirements. Our flexible and responsive team helps you work through it at your own pace.

Privacy Type 1 Report

Privacy Type 1 Report

We conduct the Type 1 audit at your pace to help you minimise disruption and learn through the process. Our iterative reviews and feedback help you stay on track and achieve real operational benefits for your company. Type 1 demonstrates your privacy by design to achieve your chosen regulations and standards.

Privacy Type 2 Report

Privacy Type 2 Report

We conduct annual recurring reviews to issue updated reports that show your continued commitment to ESG practices.

Ready to get started on your compliance journey?

THE BENEFITS

Clear reasons to act

alab-international-credibility-icon

International credibility

A globally recognised attestation
report to build trust at scale

alab-customer-confort-and-trust-icon

Customer comfort and trust

A detailed report addressing crucial
customer due diligence questions

alab-minimal-business-disruption-icon

Minimal business disruption

Agile and flexible audits that help minimise
disruption while meeting client deadliness

alab-choice-of-goalposts-icon

Choice of goalposts

Set your target to include one or more privacy regulations in trust-building attestations

alab-multi-standard-compliance-icon

Multi-standard compliance

Combine one or more privacy attestations with other compliance standards like SOC 2 and HIPAA 

alab-recognition-of-partial-progress-icon

Recognition of partial progress

The ability to achieve privacy attestation
reports with known process improvements

FAQ

Your questions answered

What is GDPR Compliance?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that sets out rules and guidelines for the processing and protection of personal data within the European Union. It grants individuals greater control over their personal information, imposes obligations on organisations handling data, and aims to ensure a high level of privacy and security for individuals' data.

The GDPR establishes principles for lawful and transparent data processing, consent requirements and rights for individuals to access and control their data. It introduces significant penalties for non-compliance, aiming to foster a more responsible and privacy-centric approach to data management in the digital age.

What is CCPA/CPRA Compliance?

The California Consumer Privacy Act (CCPA) of 2018 is a state-wide data privacy law that regulates how businesses all over the world are allowed to handle the personal information (PI) of California residents. Considered one of the strictest privacy laws in the United States, this law sets a new standard for privacy rights in California. 

CPRA is the revised version of CCPA, so you’ll hear it referred to as CCPA 2.0, CPRA or CCPA version 2.

 

Is an attestation report the same as compliance?

No, there are differences. Regulations like GDPR compliance are mandatory obligations that apply if your data processing activities meet the criteria of the regulation. The regulation sets out the detailed compliance requirements. If you operate in accordance with those requirements, you are compliant, regardless of whether you issue an attestation report. 

An attestation report is used to provide third parties with evidence of your compliance with an independent audit that earns and maintains trust. That’s especially important where your customers rely on your compliance for their compliance, eg. If they are using your software or services with the personal data of their customers. 


Which privacy regulations do I need to comply with?

Many global privacy regulations may apply to your data processing activities.

For regulations like the GDPR, Australian Privacy Principles and New Zealand Privacy Act, there is no materiality level applied. That means you need to comply with the regulations if you collect any personal data from citizens of the EU, Australia or New Zealand respectively.

Regulations like the California Privacy Act (CCPA/CPRA) and several other American state-specific regulations, there is a materiality level applied to the scale of data collected and in some cases the company turnover and whether the sale of personal data is conducted.

The International Association of Privacy Professionals (IAPP) has some great resources to guide you on your requirements, including this helpful 
mapping of global regulations.

Do I need to engage legal counsel?

It is common to engage legal counsel to interpret the requirements of the regulation and how they apply to your data processing activities and operations. However, this is not required by the regulation itself. Many organisations, especially with a simpler or smaller scope of handling personal data can often follow the principles and requirements of the regulation without needing legal counsel.

What are Type 1 and Type 2 reports?

A Type 1 report attests to your compliance by design. It’s a snapshot in time that can be achieved by showing you have the right systems and processes to satisfy the relevant privacy regulatory clauses.

A Type 2 report attests to your compliance by both design and operation over a period of time. It covers a period between 3-12 months to show your systems and processes have been operated consistently to satisfy the relevant privacy regulatory clauses.

Usually, a Type 1 report is issued first to baseline compliance. That marks the start of the live and recurring Type 2 audit periods for reports issued annually.

How do regulations based on principles work, like GDPR?

Regulations like the GDPR and other similar privacy rights and acts are based on principles. That provides flexibility and room for judgment when it comes to applying those regulations. It recognises that there is subjectivity and varied circumstances that apply when handling personal data. 

The articles of the GDPR and other privacy regulations give more specific guidance and some hard requirements driven by those overarching principles designed to protect consumer’s interests.

How do I write a compliant privacy policy?

We developed PolicyTree to address the challenge of defining and documenting compliance policies. PolicyTree collects data points about the privacy regulations that apply, your data processing activities and systems and what’s relevant to your privacy practices. You select the components that apply and input details related to your preferences or current state of operation to generate a set of policies, including a Privacy Statement and Privacy Policy document. This links through to the relevant acts and clauses from 16 privacy regulations including the GDPR.

OTHER STANDARDS

Earn trust with other leading standards

alab-blended-audits-icon

Blended Audits

Combine two or more compliance frameworks into a single blended audit process without duplication to scale trust, not costs and effort.

alab-hipaa-icon

HIPAA

The de facto global and best practice standard for proving secure handling of electronic protected health information (ePHI).

alab-custom-framework-icon

Custom Frameworks

Manage any compliance obligations from customers, regulators or your own internal risk requirements with custom frameworks.

alab-iso-27001-icon

ISO 27001

An international framework to apply a structured and best practice methodology for managing information security.

alab-csa-star-icon

CSA STAR

A comprehensive, best practice standard for cloud security to achieve Level Two accreditation in the security, trust and risk (STAR) register.

alab-cdr-icon

Consumer Data Right

Access consumer data in Australia’s economy-wide open data regime with Consumer Data Right accreditation.

alab-esg-icon

ESG Reporting

A flexible and lightweight framework to report up to 500+ positive impact activities supporting environmental, social and governance (ESG) objectives.

alab-gdpr-icon

GDPR

The global gold-standard for privacy. GDPR is regulated for personal data collected from EU citizens, and an effective framework to satisfy enterprise customers globally.

alab-soc1-sox-itgc-icon

SOC 2

Trust services criteria to satisfy a broad customer base globally for security, availability, confidentiality, privacy and processing integrity.

alab-gdpr-icon

GDPR

The global gold-standard for privacy. GDPR is regulated for personal data collected from EU citizens, and an effective framework to satisfy enterprise customers globally.

Get started your way

We’re ready when you are